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About This Guide 


This guide helps businesses understand and meet their new obligations under Part 1 of the 
Personal Information Protection and Electronic Documents Act. * 


The Act sets out ground rules for the management of personal information in the private sector. 


It balances an individual's right to the privacy of personal information with the need of 
organizations to collect, use or disclose personal information for legitimate business purposes. 


The Act establishes the Privacy Commissioner of Canada as the ombudsman for complaints under 
the new law. The Commissioner seeks whenever possible to solve problems through voluntary 
compliance, rather than heavy-handed enforcement. The Commissioner investigates complaints, 
conducts audits, promotes awareness of and undertakes research about privacy matters. The 
Commissioner is also the ombudsman for complaints under the Privacy Act, which covers the 
federal public sector. 


Part 1 of the Act comes into force in three phases, beginning January 1, 2001. 


For more information, contact: 


The Office of the Privacy Commissioner of Canada 
112 Kent Street 
Ottawa, Ontario K1A 1H3 


Telephone: 1 (613) 995-8210 
Toll-free: 1 800 282-1376 
Fax: 1 (613) 947-6850 

Web site: www.privcom.gc.ca 
E-mail: info@privcom.gc.ca 


IP34-7/2000 
ISBN: 0-662-65406-4 
December 2000 


* This guide deals only with Part 1 of the Act. All references to the Act in this document refer only to Part 1.Parts 2 to 5 of the Act concern the 
use of electronic documents and signatures as legal alternatives to original documents and signatures. For information on these, contact 
the Department of Justice. 
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A Word from the Privacy 
Commissioner of Canada 


George Radwanski 
Privacy Commissioner of Canada 


he passage of the Personal Information Protection and Electronic Documents Act 
marks a significant step forward for Canada, putting it in the forefront of those nations 
embracing technological progress and electronic commerce while still protecting 

and enhancing long-cherished fundamental rights. 


That Canadians are concerned about privacy, that they are enthusiastic about the new econ- 
omy but cautious about their personal information, is old news.What businesses may find to 
be real news is that they themselves can benefit from observing the privacy principles and 
fair information practices set out in the Personal Information Protection and Electronic 
Documents Act.What the Act is really about is good information management practices, and 
every organization benefits from those. We've prepared this guide to help businesses appreci- 
ate what's required of them under the Act, and to help them get the full benefit of adopting 
the fair information practices that are the heart of the Act. 


The Act is not unfailingly simple and straightforward - it is legislation, after all - though 

the principles it sets out are plain enough. The Canadian Standards Association's Model Code 
for the Protection of Personal Information, which was developed by business in its own 
consultative process, is incorporated into the Act as an appendix (or, in the words of the 
legislative drafters, a Schedule). Reading the Act requires some jumping back and forth 
between the text of the statute proper and the text of the appended Code. 


| think the Act reflects the process of its creation, the hammering out of a consensus between 
business professionals, consumer advocates, and public policy experts. |! also think businesses 
will find any inconveniences of the Act's structure a small price to pay for a system of regula- 
tion that reflects their input, their needs, the realities of their various ways of doing business. 
I'm hopeful that, for most businesses, the administration of the Act will feel more like self- 
regulation than government regulation. And, again, the privacy principles and fair information 
practices set out in the Act are not difficult to understand: they are good business practice, 
and they make good sense. 


As you read the guide, you'll note the role played by my office: primarily a privacy 
ombudsman, determined to get to the bottom of problems and find solutions that work 
well for all parties.| take that role very seriously, and | want you to be assured that our over- 
sight role includes giving help and advice to businesses searching for better ways to protect 
privacy. I’m looking forward to a vigorous, respectful relationship with business as we move 
into this new era of privacy protection. We all have a challenge, we all have much to learn —- 
and we all have a great deal to gain. 


This guide to the legislation is the work of many people and many months.| want to express 
my appreciation to the numerous private sector organizations that have donated their time 
and expertise to reviewing the guide at various stages of its development. Your advice and 
comments have been unfailingly thoughtful and practical. 


| look forward to continuing this co-operative relationship as we work together to protect 
Canadians’ right to privacy in the months and years ahead. 


George Radwanski 


Privacy Commissioner of Canada 


The Act in Brief 


rganizations covered by the Act 

must obtain an individual's consent 

when they collect, use or disclose the 
individual's personal information. The indi- 
vidual has a right to access personal infor- 
mation held by an organization and 
to challenge its accuracy, if need be. Personal 
information can only be used for the pur- 
poses for which it was collected. If an organi- 
zation is going to use it for another purpose, 
consent must be obtained again. Individuals 
should also be assured that their information 
will be protected by specific safeguards, 
including measures such as locked cabinets, 
computer passwords or encryption. 


Personal information 


Personal information includes any factual or 
subjective information, recorded or not, 
about an identifiable individual. This 
includes information in any form, such as: 


m age,name,!D numbers, income, ethnic 
origin, or blood type 

B opinions, evaluations, comments, social 
status, or disciplinary actions 

= employee files, credit records, loan 
records, medical records, existence of a 
dispute between a consumer and a 
merchant, intentions (for example, to 
acquire goods or services, or change jobs). 


Personal information does not include the 
name, title or business address or telephone 
number of an employee of an organization. 


Complaints 

An individual may complain to the 
organization in question or to the Privacy 
Commissioner of Canada about any alleged 
breaches of the law. The Commissioner may 
also initiate a complaint. 


Application to the 
Federal Court 


After receiving the Commissioner’s investi- 
gation report, a complainant may apply to 
the Federal Court for a hearing under certain 
conditions as set out in Section 14 of the Act. 
The Privacy Commissioner of Canada may 
also apply to the Court on his own or on the 
complainant's behalf. The Court may order 
an organization to change its practices 
and/or award damages to a complainant, 
including damages for humiliation suffered. 


Audits 


The Commissioner may, with reasonable 
grounds, audit the personal information 
management practices of an organization. 


Whistleblowing 


Anyone who believes that any of Sections 

5 to 10 of the Act have been or are about 
to be contravened may notify the 
Commissioner, and ask that his or her 
identity be kept confidential. Once the 
Commissioner has given his assurance, 

he is bound to protect the person's identity. 
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Offences or who refuses to contravene Sections 
5 to 10 of the Act 


Itis. an offence to: B® obstruct a complaint investigation or 


= destroy personal information that an an audit by the Commissioner or his 
individual has requested delegate. 

® retaliate against an employee who has A person is liable to a fine of up to $10,000 
complained to the Commissioner on summary conviction or up to $100,000 


for an indictable offence. 


DEFINITIONS 


Federal work, undertaking or business 

Includes “any work, undertaking or business that is under the legislative authority of Parliament’ While most 
federally regulated organizations would be captured under this definition, not all these types of organizations 
are federal works. For instance, insurance companies and credit unions may be subject to some federal regulation, 
but are considered to be within provincial jurisdiction under the Constitution and are not federal works for the 
purposes of the Act. The Act defines some of the specific federal works subject to Part 1 as follows: 
inter-provincial or international transportation by land or water 

airports, aircraft or airlines 

telecommunications 

radio and television broadcasting 

banks 

grain elevators 

nuclear facilities 


offshore drilling operations. 


Note that this is not an exhaustive list of “federal works, undertakings and businesses” The fact that your company is 
federally incorporated does not necessarily mean that it is a federal work, undertaking or business. If your company 
is subject to any part of the Canada Labour Code, it is probably a federal work, undertaking or business. 


Commercial activity 


Any particular transaction, act, or conduct, or any regular course of conduct that is of acommercial character, 
including the selling, bartering or leasing of donor, membership or other fund-raising lists. 


Organization 

An organization includes an association, a partnership, a person or a trade union. 

Consent 

Voluntary agreement with what is being done or proposed. Consent can be either express or implied. Express con- 
sent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference 


on the part of the organization seeking consent. Implied consent arises where consent may reasonably be inferred 
from the action or inaction of the individual. 


Disclosure 

Making personal information available to others outside the organization. 

Use 

Refers to the treatment and handling of personal information within an organization. 


Is Your Organization 


Subject to the Act? 


The Act affects organizations 
in three stages: 


January 1, 2001 


In its first stage, the Act applies to personal 
information (except personal health infor- 
mation) that is collected, used or disclosed 
in the course of commercial activities by 


federal works, undertakings and businesses. 


This includes, but is not limited to, federally- 
regulated organizations such as banks, 
telecommunications and transportation 
companies. 

At this stage the Act also applies to 
personal data that is collected, used or 
disclosed by these same organizations 
about their employees. 

In addition, at this stage the Act applies 
to disclosures of personal information for 
consideration across provincial or national 
borders, by organizations such as credit 
reporting agencies or organizations that 
lease, sell or exchange mailing lists or other 
personal information. The information itself 
must be the subject of the transaction and 
the consideration is for the information. 

The Act covers all businesses and organi- 
zations engaged in commercial activity in 
Yukon, Northwest Territories and Nunavut. 


January 1, 2002 


The Act extends to personal health informa- 
tion for the organizations and activities 
covered in the first stage. Personal health 
information is defined as information about 
an individual’s mental or physical health, 
including information concerning health 
services provided and information about 
tests and examinations. 


January 1,2004 


The Act extends to the collection, use or dis- 
closure of personal information in the course 
of any commercial activity within a province. 
However, the federal government may 
exempt organizations and/or activities in 
provinces that have adopted substantially 
similar privacy legislation. 

The Act will also apply to all personal 
information in all interprovincial and inter- 
national transactions by all organizations 
subject to the Act in the course of their 
commercial activities. 

Quebec is the only province that currently 
has legislation dealing with personal infor- 
mation in the private sector. The federal 
government has stated that this legislation 
meets the test of “substantially similar” and 
that organizations and activities subject to 
the Quebec legislation will be exempted 
from the federal act for intraprovincial 
matters. 

Other provinces and territories are con- 
sidering private sector legislation. 


Is your organization a federal work, undertaking or business 
that collects, uses or discloses personal information in the 
course of a commercial activity? 


If YES, you are subject to the Act as of January 17,2001. It also 
applies to your employees’ personal information as well as 
your customers. 

lf NO: 

Do you disclose personal information outside the province for 
consideration? In other words, is personal information the 
subject of the transaction? 


If YES, that disclosure is subject to the Act beginning 
January 1,2001. 
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What is Not Covered 
by the Act? 


The collection, use or disclosure of per- 
sonal information by federal government 
organizations listed under the Privacy Act. 


Provincial or territorial governments and 
their agents. 


An employee's name, title, business 
address or telephone number. 


An individual's collection, use or disclo- 
sure of personal information strictly for 
personal purposes (e.g. personal greeting 
card list). 


An organization’s collection, use or disclo- 
sure of personal information solely for 
journalistic, artistic or literary purposes. 


Your Responsibiliti 


Under the Act 


rivate sector organizations must follow 

a code for the protection of personal 

information, which is included in the 
Act as Schedule 1. 

The code was developed by business, 
consumers, academics and government 
under the auspices of the Canadian 
Standards Association. It lists 10 principles 
of fair information practices, which form 
ground rules for the collection, use and 
disclosure of personal information. These 
principles give individuals contro! over how 
their personal information is handled in the 
private sector. 

An organization is responsible for the 
protection of personal information and the 


fair handling of it at all times, throughout the 


organization and in dealings with third par- 
ties. Care in collecting, using and disclosing 


personal information is essential to continued 


consumer confidence and good will. 


The 10 principles that businesses must 
follow are: 
1. Accountability 


2. Identifying purposes 
3. Consent 
4. Limiting collection 
5. Limiting use, disclosure and retention 
6. Accuracy 
7. Safeguards 
8. Openness 
9. Individual access 
10. Provide recourse 


es 


These principles must be read in conjunc- 
tion with key sections of the Act, particularly 
including: 


Sections 2 to 10 of the Act 


Schedule 1 must be read in conjunction with 
Sections 2 to 10 of the Act. It is essential to 
carefully consider the obligations set out in 
these sections, along with the 10 principles. 


Section 2 

« Provides definitions including commercial 
activity, federal work, undertaking or busi- 
ness, personal information, personal 
health information and organization. 

= Specifies that the notes under clauses 
4.3 and 4.9 of Schedule 1 are not part of 
the law. 


Section 3 

Defines the purpose of the Act: 
recognizes individuals’ right to privacy of 
their personal information 
recognizes the need of organizations to 
collect, use or disclose personal informa- 
tion for legitimate business purposes 

= establishes rules for handling personal 
information. 


Section 4 

defines the scope of the Act's application: 

® covers all organizations that collect, use or 
disclose personal information in the 
course of commercial activities 
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THE REASONABLE 


® includes the personal information of an 
employee of a federal work, undertaking 
or business but not the personal informa- 
tion of other private sector employees. 


Section 5 


® Stipulates that every organization must 
comply with the obligations of Schedule 1. 


m Indicates what is not covered by the Act. 


B® Inthe Schedule: 
» “shall” means an obligation 
» “should” means a recommendation, 
not an obligation. 


™ Limits the collection, use and disclosure 
to purposes that a reasonable person 
would consider appropriate in the 
circumstances. The reasonable person's 
perspective must be taken into account 
when applying any aspect of Part 1 of 
the Act. 


Section 6 


= Establishes that identifying an individual 
to be accountable for compliance does 
not mean that the organization is not 
responsible for its obligations as set out in 
Schedule 1. 


Section 5 of the Act limits the collection, use and disclosure for 
purposes that a“reasonable person” would consider appropriate 


in the circumstances. 


Examples: 


Would a customer renting a movie from a video store consider 
it reasonable to be required to provide a telephone number? 
An address? A Social Insurance Number? 

Would a customer paying cash for a product or service 
consider it reasonable to be asked for a name, address and 
phone number? 


Section 7 


= Specifies the circumstances when personal 
information may be collected, used or dis- 
closed without the individual’s consent. 


Section 8 


= Sets out procedures for individuals to 
make requests for personal information 
and corrections to that information. 


Section 9 


™ Explains when access to personal 
information may be refused. 


Section 10 


= Defines an organization's obligation to 
provide personal information in an alter- 
native format (e.g. Braille, large print or 
audio tape) to a person with a sensory 
disability. 


Fair Information Principles 


The following section sets out the responsi- 
bilities for each of the 10 fair information 
principles of Schedule 1.It outlines how 

to fulfil these responsibilities and offers 
some tips. 


YOUR RESPONSIBILITIES UNDER THE ACT 


1. Be accountable 


SSanEnenereeseneee 


Your responsibilities 


= Comply with all 10 of the principles of 
Schedule 1. 


® Appoint an individual (or individuals) to 
be responsible for your organization's 
compliance. 


m Protect all personal information held by 
your organization or transferred to a third 
party for processing. 


= Develop and implement personal infor- 
mation policies and practices. 


How to fulfil these responsibilities 


m Give your designated privacy official sen- 
ior management support and the author- 
ity to intervene on privacy issues relating 
to any of your organization's operations. 


= Communicate the name or title of this 
individual internally and externally (e.g. 
on Web sites and in publications). 


m Analyze all personal information handling 
practices including ongoing activities and 
new initiatives, using the following check- 
list to ensure that they meet fair informa- 
tion practices: 

» What personal information do 
we collect? 

» Why do we collect it? 

« How do we collect it? 

» What do we use it for? 

«= Where do we keep it? 

» How is it secured? 

« Who has access to or uses it? 

« To whom is it disclosed? 

» When is it disposed of? 


= Develop and implement policies and pro- 
cedures to protect personal information: 
« define the purposes of its collection 
» obtain consent 
limit its collection, use and disclosure 
=» ensure information is correct, complete 
and current 
» ensure adequate security measures 
« develop or update a retention and 
destruction timetable 


= process access requests 
* respond to inquiries and complaints 


Include a privacy protection clause in 
contracts to guarantee that the third 
party provides the same level of protec- 
tion as your organization does. 

Inform and train staff on privacy policies 
and procedures. 

Make information available explaining 
these policies and procedures to 
customers (e.g. in brochures and on 
Web sites). 


TIPS 


Train your front-line and management staff and keep them 

informed, so they can answer the following questions: 

® How dol respond to public inquiries regarding our organiza- 
tion’s privacy policies? 

m What is consent? When and how is it to be obtained? 

® How dol recognize and process requests for access to 
personal information? 

® Towhom should | refer complaints about privacy matters? 

m What are my privacy protections and rights? (This applies to 
employees in federally regulated organizations.) 

m What are the ongoing activities and new initiatives relating to 
the protection of personal information at our organization? 

When transferring personal information to third parties, 

ensure that they: 
Name a person to handle all privacy aspects of the contract. 

w Limit use of the personal information to the purposes specified 
to fulfil the contract. 

m Limit disclosure of the information to what is authorized by your 
organization or required by law. 

= Refer any people looking for access to their personal informa- 
tion to your organization. 

m Return or dispose of the transferred information upon 
completion of the contract. 

a Use appropriate security measures to protect the personal 
information 

= Allow your organization to audit the third party’s compliance 
with the contract as necessary. 


YOUR PRIVACY RESPONSIBILITIES - A GUIDE TO CANADA’S PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT 


TIPS 


2. Identify the purpose 


Your organization must identify the reasons 
for collecting personal information before or 
at the time of collection. 


Your responsibilities 


Before or when any personal information 
is collected, identify why it is needed and 
how it will be used. 


Document why the information is 
collected. 

Inform the individual from whom the 
information is collected why it is needed. 


Identify any new purpose for the informa- 
tion and obtain the individual's consent 
before using it. 


= Define your purposes for collecting data as clearly and narrowly 
as possible so the individual can understand how the informa- 
tion will be used or disclosed. 


= Avoid overly broad purposes as they may conflict with the 
knowledge and consent principle. 

=m Examples of purposes include: 
* Opening an account 
= verifying creditworthiness 
= providing benefits to employees 
= processing a magazine subscription 
= sending out association membership information 
= guaranteeing a travel reservation 


identifying customer preferences 
establishing customer eligibility for special offers 
or discounts. 


How to fulfil these responsibilities 


= Review your personal information hold- 


ings to ensure they are all required for a 
specific purpose. 

Notify the individual, either orally or in 
writing, of these purposes. 


Record all identified purposes and 
obtained consents for easy reference in 
case an individual requests an account 
of such information. 


Ensure that these purposes are limited to 
what a reasonable person would expect 
under the circumstances. 


GRANDFATHERING | 


Personal information that your company 
has collected during the course of its 
commercial activities is subject to the Act. 
Since it has already been collected, you 
don't need to recollect it. However, in 
order to continue to use or disclose this 
information, you now require consent. 
Some organizations have informed all 
their customers what they do with their 
information, to whom it is disclosed and 
given customers the option to object to 
these ongoing uses or disclosures. 


YOUR RESPONSIBILITIES UNDER THE ACT 


3. Obtain consent 


Your responsibilities aD 


rt 
= Inform the individual in a meaningful way riPsS 
of the purposes for the collection, use or 


Consent is normally obtained from the individual whose 
disclosure of personal data. 


personal information is collected, used or disclosed. 

For an individual who is a minor, seriously ill, or mentally 
incapacitated, consent may be obtained from a legal guardian, 
or person having power of attorney. 


How to fulfil these responsibilities* ® Consent is only meaningful if the individuals understand how 
their information will be used. 


® Obtain the individual's consent before or a 
at the time of collection, as well as when a 
new use is identified. 


® Obtain consent from the individual! 
whose personal information is collected 
used or disclosed. 


® Consent clauses should: 
= be easy to find 
» use clear and straightforward language 
» not use blanket categories for purposes, uses 
and disclosures 


= Communicate in a manner that is clear 
and can be reasonably understood. 


= Record the consent received (e.g. note to be specific as possible about which organizations 
file, copy of e-mail, copy of checkoff box). handle the information. 

= Never obtain consent by deceptive ® Consent can be obtained in person, by phone, by mail, via 
means. the Internet etc. 

= Donot make consent a condition for » The form of consent should take into consideration: 
supplying a product or a service, unless » reasonable expectations of the individual 
the information requested is required circumstances surrounding the collection 
to fulfil an explicitly specified and sensitivity of the information involved. 
legitimate purpose. ™ Express consent should be used whenever possible and in all 


cases when the personal information is considered sensitive. 
Relying on express consent protects both the individual and 
the organization. 


m Explain to individuals the implications 
of withdrawing their consent. 

= Ensure that employees collecting 
personal information are able to answe! 
an individual's questions about the 
purposes of the collection. 


* There are some exceptions to the principle of obtaining ¢ 
See page 17 of this guide. 
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4. Limit collection 


Your responsibilities How to fulfil these responsibilities 

® Do not collect personal information = Limit the amount and type of the infor- 
indiscriminately. mation gathered to what is necessary 

= Do not deceive or mislead individuals for the identified purposes. 
about the reasons for collecting personal m Identify the kind of personal information 
information. you collect in your information-handling 


policies and practices. 


SGeRGGREERG : w= # Ensure that staff members can explain 
TIPS why the information is needed. 


= By reducing the amount of information gathered, you can 
lower the cost of collecting, storing, retaining and ultimately 
archiving data. 

= Collecting less information also reduces the risk of inappropriate 
uses and disclosures. 


YOUR RESPONSIBILITIES UNDER THE ACT 


5. Limit use, disclosure and retention 


Your responsibilities f information that does not 


m Use or disclose personal information only ’ specific purpose or that no longer 
for the purpose for which it was collected ‘uitils its Intended purpose. 
unless the individual consents, or the use Dispose of personal information in a way 
or disclosure is authorized by the Act. that prevents improper access. Shredding 


all 


= Keep personal information only as long as es or deleting electronic records 


necessary to satisfy the purposes. ire idea 


= Put guidelines and procedures in place Establish policies setting out the types of 
for retaining and destroying personal information that need to be updated. An 
itoeniation. organization can reasonably expect an 


ndividual to provide updated informa- 
1 certain circumstances (e.g. change 
f address for a magazine subscription). 


m= Keep personal information used to make 
a decision about a person for a reason- 
able time period. This should allow the 
person to obtain the information after the 
decision and pursue redress. 

= Destroy, erase or render anonymous info 
mation that is no longer required for an it may be less onerous and complicated to destroy or erase 
identified purpose or a legal requirement nformation than to make personal information anonymous. 

Conduct regular reviews to help determine whether information 


is still required. Establish a retention schedule to make 
this easier. 


How to fulfil these responsibilities 


= Document any new purpose for the use 
of personal information. 


m Institute maximum and minimum reten- 
tion periods that take into account any 
legal requirements or restrictions and 
redress mechanisms. 
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6. Be accurate 


Your responsibilities 

& Minimize the possibility of using incorrect 
information when making a decision 
about the individual or when disclosing 
information to third parties. 


=m One way to determine if information needs to be updated is to 


ask whether the use or disclosure of out of date or incomplete 
information would harm the individual. 


= Apply the following checklist for accuracy: 


12 


= List specific items of personal information required to provide 
a service. 

» List the location where all related personal information can 
be retrieved. 

» Record the date when the personal information was obtained 
or updated. 

= Record the steps taken to verify accuracy, completeness and 
timeliness of the information. This may require reviewing your 
records or communicating with the client. 


How to fulfil these responsibilities 


= Keep personal information as accurate, 
complete and up to date as necessary, 
taking into account its use and the inter- 
ests of the individual. 

= Update personal information only when 
necessary to fulfil the specified purposes. 

= Keep frequently used information accu- 


rate and up to date unless there are 
clearly set out limits to this requirement. 


YOUR RESPONSIBILITIES UNDER THE ACT 


7. Use appropriate safeguards 


Your responsibilities Make ir employees aware of the 


1ce of maintaining the security 


» 
x 


= Protect personal information against loss 


or theft. onfidentiality of personal 
= Safeguard the information from unautho ; . 
rized access, disclosure, copying, use or ' Ensure staff awareness by holding regular 
modification. staff training on security safeguards. 
™ Protect personal information regardless = The following factors should be considered 
of the format in which it is held. n selecting appropriate safeguards: 
ensitivity of the information 
How to fulfil these responsibilities amount of information 
= Develop and implementa security policy extent of distribution 
to protect personal information. format of the information (electronic, 
m Use appropriate security safeguards sti : 7 
of storage. 


to provide necessary protection: 
» physical measures (locked filing m Review and update security measures 
cabinets, restricting access to offices, rec 
alarm systems) 


» technological tools (passwords, encryp Sa ae i 
tion, firewalls, anonymizing software) TIPS 
* organizational controls (security 
clearances, limiting access on a m |Vake sure personal information that has no relevance to the 
“need-to-know" basis, staff training, transaction is either removed or masked when providing copies 
agreements). of information to others. 


| Keep sensitive information files in a secure area or computer 
ystem and limit access to individuals on a“need-to-know” 
basis only. 


Te Sa “cet 
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TIPS 


8. Be open 


Your responsibilities 


Inform customers, clients and employees 
that you have policies and practices 

for the management of personal 
information. 


Make these policies and practices under- 
standable and easily available. 


How to fulfil these responsibilities 


Ensure front-line staff is familiar with the 
procedures for responding to individual 
inquiries. 


Information about these policies and practices may be made 
available in person, in writing, by telephone, in publications or on 
your organization’s Web site. 


Make the following available: 


name or title and address of the person 
who is accountable for your organiza- 
tion’s privacy policies and practices 
name or title and address of the person 
to whom access requests should be sent 
how an individual can gain access to his 
or her personal information 

how an individual can complain to your 
organization 

brochures or other information that 
explain your organization's policies, 
standards or codes 

a description of what personal informa- 
tion is made available to other organiza- 
tions (including subsidiaries) and why it 
is disclosed. 


9. Give individua's : 


Your responsibilities 


When requested, inform individuals if 
you have any personal information 
about them. 


Explain how it is or has been used and 
provide a list of any organizations to 
which it has been disclosed. 


Give individuals access to their 
information. 


Correct or amend any personal informa 
tion if its accuracy and completeness is 
challenged and found to be deficient. 


Provide a copy of the information 
requested, or reasons for not providing 
access, subject to exceptions set out in 
Section 9 of the Act (see page 18). 


An organization should note any 
disagreement on the file and advise 
third parties where appropriate. 


How to fulfil these responsibilities 


Provide any help the individual needs to 
prepare a request for access to personal 
information. 

Your organization may ask the individual 
to supply enough information to enable 
you to account for the existence, use and 
disclosure of personal information. 


Respond to the request as quickly as 
possible and no later than 30 days after 
receipt of the request. 


The normal 30-day response time limit 
can be extended for a maximum of 30 
additional days, according to specific 
criteria set out at Subsection 8(4) of 
the Act: 

« if responding to the request within 
the original 30 days would unreason- 
ably interfere with activities of your 
organization 

« if additional time is necessary to 
conduct consultations 


iccess 


YOUR RESPONSIBILITIES UNDER THE ACT 


- 


tional time is necessary to 
vert personal information to an 
iiternate format. 


if your organization extends the time, 
you must notify the individual making 
the request within 30 days of receiving 
ne request, and of his or her right to 
complain to the Privacy Commissioner 
of Canada. 


ive access at minimal or no cost to 


Notify the individual of the approximate 
costs before processing the request. 


dividuals access to their personal 


ike sure the requested information 
standable. Explain acronyms, 
tions and codes. 
ny information that has been 
> appropriate, to any 
parties that have access to the 


od, where 
tion 
m the individual in writing when 
1g to give access, setting out the 
ind any recourse available. 
some exceptions to the princi- 
ding access (see page 18 of 


= Keep personal information about individuals in one place to 


,ake retrieval easier. Or record where all such information can 
found. Never disclose personal information unless you are 


sure of the identity of the requestor and that person's right 


io not store all personal information in one place, keep 


a record of where the information can be found to make 


retrieval easier. 
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10. Provide recourse 


Your responsibilities a 


= Develop simple and easily accessible 


complaint procedures. al 


= Inform complainants of avenues of 


recourse. These include your organiza- 7 


tion’s own complaint procedures, those 
of industry associations, regulatory bodies 


and the Privacy Commissioner of Canada. a 


= Investigate all complaints received. 


= Take appropriate measures to correct 
information handling practices and 


policies. 7 


How to fulfil these responsibilities 


= Record the date a complaint is received 


and the nature of the complaint (e.g. = 


delays in responding to a request, in- 
complete or inaccurate responses, or 
improper collection, use, disclosure or 
retention). 


TIPS 


= How well your organization handles an individual’s complaint 
may help preserve or restore the individual's confidence in your 
organization. 


m Record all decisions to ensure consistency in applying the Act. 


Acknowledge receipt of the complaint 
promptly. 

Contact the individual to clarify the 
complaint, if necessary. 


Assign the investigation to a person with 
the skills necessary to conduct it fairly 
and impartially. 

Give the investigator access to all 
relevant records, employees or others 
who handled the personal information 
or access request. 


Notify individuals of the outcome of 
investigations clearly and promptly, 
informing them of any relevant steps 
taken. 


Correct any inaccurate personal informa- 
tion or modify policies and procedures 
based on the outcome of complaints. 


Exceptions to the Consent 
and Access Principles 


here are a number of exceptions to the requirements 
to obtain consent and provide access set 
out in the Act. 


Exceptions to consent in Section 7 


Organizations may collect personal informa- _—_® ‘if the use is clearly in the individual's 
tion without the individual's knowledge or interest and consent is not available in a 
consent only: timely way 
@ if itis clearly in the individual's interests a if knowledge and consent would 
and consent is not available in a timely way compromise the availability or accuracy 
= if knowledge and consent would compro- of the information and collection was 
mise the availability or accuracy of the required to investigate a breach of an 
information and collection is required to agreement or contravention of a federal 
investigate a breach of an agreement or or provincial law, 
contravention of a federal or provincial law — Organizations may disclose personal infor- 
® for journalistic, artistic or literary purposes iation without the individual’s knowledge 
@ if itis publicly available as specified in the nt only: 
regulations. ) a lawyer representing the organization 


Organizations may use personal information lect a debt the individual owes to 


without the individual's knowledge or 
consent only: omply with a subpoena, a warrant or 


der made by a court or other body 
ppropriate jurisdiction 


ganization 


m if the organization has reasonable 
grounds to believe the information could 


be useful when investigating a contraven w= toagovernment institution that has 
tion of a federal, provincial or foreign requested the information, identified 
law and the information is used for that ts lawful authority, and indicates that 


investigation disclosure is for the purpose of enforcing, 
ing out an investigation, or gather- 
\telligence relating to any federal, 

ial or foreign law; or suspects 


= foran emergency that threatens an 
individual's life, health or security 


Seg a ee olally study of that the information relates to ‘national 
fesearchishie organization must notify security or the conduct of international 
Be oc aesionel of Canada affairs; or is for the purpose of administer- 
pelore using the information) ing any federal or provincial law 


m if itis publicly available as specified 
in regulations 
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= toan investigative body named in the 
Regulations of the Act or government 
institution on the organization's initiative 
when the organization believes the infor- 
mation concerns a breach of an agree- 
ment, or a contravention of a federal, 
provincial, or foreign law, or suspects the 
information relates to national security or 
the conduct of international affairs 


= if made by an investigative body for the 
purposes related to the investigation of a 
breach of an agreement or a contraven- 
tion of a federal or provincial law 


= inan emergency threatening an individ- 
ual’s life, health, or security (the organiza- 
tion must inform the individual of the 
disclosure) 


= for statistical, scholarly study or research 
(the organization must notify the Privacy 
Commissioner before disclosing the 
information) 


= toanarchival institution 


m 20 years after the individual’s death or 
100 years after the record was created 


= if itis publicly available as specified in the 
regulations 


= if required by law. 


Exceptions to access in Section 9 


Organizations must refuse an individual 
access to personal information: 


® if it would reveal personal information 
about another individual* unless there is 
consent or a life-threatening situation 


m if the organization has disclosed informa- 
tion to a government institution for law 
enforcement or national security reasons. 
Upon request, the government institution 
may instruct the organization to refuse 
access or not to reveal that the informa- 
tion has been released. The organization 
must refuse the request and notify the 
Privacy Commissioner of Canada. The 
organization cannot inform the individual 
of the disclosure to the government insti- 
tution, or that the institution was notified 
of the request, or that the Commissioner 
was notified of the refusal. 


release the remaining information. 


Organizations may refuse access to personal 
information if the information falls under 
one of the following: 


® solicitor-client privilege 
B® confidential commercial information* 


® disclosure could harm an individual's life 
or security” 


m it was collected without the individual’s 
knowledge or consent to ensure its 
availability and accuracy, and the collec- 
tion was required to investigate a breach 
of an agreement or contravention of a 
federal or provincial law (the Privacy 
Commissioner of Canada must be notified) 


m™ it was generated in the course of a formal 


dispute resolution process. 


Role of the Privacy Commissioner 
of Canada 


he Privacy Commissioner of Canada missioner protects individual rights, he 

has oversight of both the Privacy Act is alse 1dvocate for the fair information 

and Part 1 of the Personal Information principles that form the foundation of the 
Protection and Electronic Documents Act gislation. The Commissioner's thorough 
These acts protect personal information stigations and impartiality protect both 
according to internationally accepted fair dividual rights and the organization 
information principles and practices. infair accusations. 


The Commissioner is an Officer of 
Parliament, like the Auditor General of 


Canada or the Chief Electoral Officer. As ai phe sponsibilities 
Officer of Parliament, the Commissioner me ACT 
reports directly to the House of Common: he Act makes the Commissioner responsi- 
and to the Senate, not to the government ' irina compliance with the Act 
of the day. This independence ensures his 3 promoting its purposes. 
impartiality and open-mindedness in 
exercising his role as an ombudsman fo! aaa 
privacy matters. The Commissioner make ice roles 
recommendations, not orders. Howeve' ) issioner has five main ways of 
there is provision to apply to the Federal! it organizations subject to the 
Court to review a case. ' principles: 

complaints 
A privacy ombudsman ng and conciliating complaints 


F 3 : varennal i ; = 
Nearly two decades of experience investiga nal information manage 


ing complaints under the Privacy Act have 

helped define the Privacy Commissioner s orting abuses 
ombudsman role. The Privacy Commissione! ude rout 
relies on the competence, knowledge anc 
impartiality of his staff to seek whenever 
possible to resolve disputes through 
investigation, persuasion, mediation anc 
conciliation. Ideally this approach to resolv 
ing disputes can be less intimidating to 
complainants and less costly to business 
than recourse to the courts. While the 


laints to the Privacy 
ver of Canada, page 21 of 
nd Audits of Personal 
Manz nent Practices, page 25.) 
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Promoting the purposes 
of the Act 


The Commissioner promotes the purposes 
of the Act in four ways: 


m education 
m@ research 

m™ reporting 
= 


consultation and agreements. 


Education 


The Commissioner's education mandate 
includes developing and conducting public 
information programs to encourage and 
promote understanding of privacy issues. 


Research 


The Act requires the Commissioner to 
undertake and publish research about 
protecting personal information so as to 
increase knowledge and improve compli- 
ance with the Act's fair information princi- 
ples. The Commissioner may conduct 
independent research on privacy issues 
in conjunction with academic or other 
researchers. He may also provide grants 
and contributions for academic or other 
research on privacy issues. 


Reporting 


The Commissioner may make public any 
information about an organization's 
personal information management 
practices, if he considers it in the public 
interest. He reports annually to Parliament 
on privacy issues including the extent to 
which provinces have introduced similar 
legislation. 


Consultation and 
agreements 


The Commissioner may enter into agree- 
ments with provincial counterparts who 
have similar powers and duties. These 
consultations and agreements may cover 
complaint mechanisms, research, and 
developing model contracts for protecting 
personal information. The Commissioner 
will encourage organizations to develop 
detailed policies and practices to comply 
with Part 1 of the Act. 


Complaints to the 


Privacy Commission: 


of Canada 


Types of complaints 


n individual may complain to the 

Commissioner about any matter 

specified in Sections 5 to10 of the Act 
or in the recommendations or obligations 
set out in Schedule 1. This includes but is not 
limited to allegations that an organization: 


m™ denies an individual access to persona! 
information 


= improperly collects, uses or discloses 
personal information 


m refuses to correct inaccurate or incom- 
plete information 


m fails to provide access to personal infor- 
mation in an alternative format to an 
individual with a sensory disability 


= does not use appropriate safeguards to 
protect personal information. 


The Commissioner may initiate a com- 
plaint if there are reasonable grounds to 
believe that an investigation of a matter 
under Part 1 of the Act is warranted. 


Time limits 
There is no time limit for filing most types 
of complaints. 

The only exception is a complaint that 
access to personal information has been 
denied. In this case, the complaint must be 
made within six months after the organiza- 
tion’s refusal to provide the information, or 
after the expiry of the time limit for respond 
ing to the request (see page 15 of this guide 


for more on the time limit to respond toa 
request). However, the Commissioner 
may extend the time limit for an access 
complaint. 

The Commissioner has one year from the 
date of the complaint to prepare a report. 


How does the Privacy 
»mmissioner of Canada 
dle complaints? 


As an ombudsman, the Commissioner 
seeks to take a cooperative and conciliatory 
approach to investigations whenever possi- 
ble. He encourages the resolution of com- 
plaints through negotiation and persuasion. 
Alternate dispute resolution methods such 
as mediation and conciliation may be used 
» matters at any stage of the investi- 
process. Although the Commissioner 
> power to summon witnesses, admin- 
aths and compel the production of 
nce, these means are only likely to 
d if voluntary cooperation is not 
ming. 
e outset of an investigation, the 
ommissioner will notify the organization in 
1g of the substance of the complaint 
identify the investigator responsible 
ve case. The organization may submit 
entations to the Commissioner at any 


and will 


time during the process. 

The investigator assigned to the case will 
contact the organization's designated staff 
member to indicate how he or she intends 
to proceed with the investigation and, if 
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possible, which records need to be reviewed 
and which staff members may be inter- 
viewed. The investigator may also indicate 
whether on-site visits will be needed. 

Investigators obtain information directly 
from individuals familiar with the matter 
under investigation. These interviews are 
conducted in private. Investigators may also 
require access to original documents. 
Documents given to an investigator are 
returned within 10 days of a request for their 
return, but they may be asked for again if the 
need arises. 

Prior to finalizing the investigation, the 
results are disclosed to the parties involved. 
They may make additional representations if 
they see fit. This also gives them the oppor- 
tunity to resolve the matter before the com- 
plaint is finalized. 

The investigator submits the results of the 
investigation to the Commissioner along 
with any representations. The Commissioner 
will consider the case and issue a report to 
the parties. The Commissioner can request 
that an organization give the Commissioner, 
within a specified time, notice of any action 
taken or proposed to be taken to implement 
report recommendations, or explain why no 
action has or will be taken. The report 
includes the results of the investigation, any 
settlement reached by the parties, recom- 
mendations such as suggested changes in 
information management practices, what 
steps the organization has taken or will 
take to address these recommendations 
and, if applicable, notice of recourse to the 
Federal Court. 


A complaint may be disposed of in one of 
the following three ways: 


1. Not well founded 


There is no evidence to lead the 
Commissioner to conclude that the 
organization violated the Act. 


2. Well founded 


The investigation revealed that the organiza- 
tion failed to respect a provision of the Act 
and the complaint was not resolved. 


3. Resolved 


The investigation supports the complaint, 
but the organization agrees to take correc- 
tive action to remedy the situation. For 
example, the organization agrees to release 
personal information previously denied. 
The complaint may also be resolved if it 
appears to be the result of miscommunica- 
tion or misunderstanding. For example, an 
organization misunderstood the request 
and now agrees to release the personal 
information sought by the complainant. 
The complaint is also resolved if the 
complainant is satisfied with the 
Commissioner's efforts and the results. 


The Commissioner is not required to issue 
an investigation report if: 


= the complainant has not pursued 
alternate redress mechanisms that are 
reasonably available 


m the case could be more appropriately 
dealt with through other legislation 


=™ too much time has passed since the 
matter that prompted the complaint 
and reporting would serve no useful 
purpose 


m the complaint is trivial, frivolous or 
vexatious, or is made in bad faith. 


Public disclosure 


The Privacy Commissioner of Canada may 
make public any information relating to the 
personal information management practices 
of an organization if the Commissioner con- 
siders that it is in the public interest to do so. 


Applications to the 
Federal Court 


complainant may apply to the Federal Court fora hearing. The Privacy 
Commissioner of Canada may apply on his own or ona complainant's 


behalf. Normally, an application must be made within 45 days of the 
Commissioner’s report. 


What Matters Can Be Hear 


The Court will consider applications arising 4.7 Whether an organization has taken 
from the complaint or any matter referred to he necessary steps to safeguard the 
in the Commissioner's report and that is information. 
referred to in one of the following: 4.8 /hether an organization has made 
fic information about its personal 

Under Schedule 1 mation management satel 
4.1.3 Whether an organization has properly idily available to individuals. 

exercised its responsibility for the . 

personal information in its possessior Under Schedule 1 as modified by 


including information transferred t sections 5 to 10 of the Act 


third party. 4 her personal information has 

4.2. Whether an organization has proper!) collected, used or disclosed 
identified and documented the pur- ut the knowledge or consent 
poses for which personal information f t \dividual, except where 
is being collected, used or disclosed, a’ nitted or required. (See page 17 
or before the time of collection. this guide.) 

4.3.3 Whether an organization has refused n organization has used or 
to provide a service to an individua! isclosed personal information for 
because the individual would not other than those for which it 
consent to the collection, use or dis ted, without the consent of 
closure of more information than Jual and in circumstances 
necessary for the specified purpose suthorized by the Act. As well, 

4.4 Whether an organization has collectec ther an organization has retained 
more information than necessary \formation long enough for a 
for the purposes or whether it was nant to exhaust his remedies 
collected by fair and lawful means. ar the Act 

4.6 Whether the information is accurate, 4.9 Whether an individual was wrongly 


up-to-date and as complete as Jenied access to information about 


necessary. himself except where permitted or 


equired. (See page 18 of this guide.) 
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Sections of the Act 


5(3) 


8(6) 


Whether the information was collected, 
used or disclosed only for purposes 
that a reasonable person would con- 
sider appropriate. 

Whether an individual has been 
charged too much for access to infor- 
mation or was not notified in advance 
of the cost. 


8(7) Whether an organization has informed 
the individual in writing of a refusal to 
give access, has given the reasons for 
the refusal and set out the appropriate 
recourse available. 

10 Whether an organization has failed to 
grant access in an alternative format 
to an individual with a sensory 
disability. 


Remedies available through Federal Court 


The Federal Court may order an organization 
to correct practices that do not comply with 
Sections 5 to 10 of the Act. The Court may 
also order an organization to publish a 
notice of any action taken or proposed to 


correct its practices. The Court can award 
damages to a complainant, including 
damages for humiliation. There is no 
ceiling on monetary damages that the 
Court may award. 


Audits of Persona! 
Management Pract: 


he Act gives the Privacy Commissione: 


of Canada the authority to audit an poweé 


organization's personal information C 
management practices when he has reason 
able grounds to believe the organization is 
not fulfilling its obligations under Part 1 of 
the Act or is not respecting the recommen 
dations of Schedule 1. 


What can lead to an audit? 


The following are examples of circumstances 
that may lead the Commissioner to audit 
personal information management practice 
of an organization: 


™ agroup or series of complaints about a 
particular organization’s practice(s) 

® information provided by an individual! 
under the whistleblower provision 


™ anissue receiving media attention. 


What to expect from an 
audit by the Commissione: 


In keeping with the Commissioner's 
ombudsman approach, privacy audits are 
non-confrontational whenever possible 
and can be useful for organizations wantin: 
to improve their personal information 
handling practices. 

The Commissioner will inform the organi: 
zation in writing that an audit will be under- 
taken. The letter will specify the audit's focus 
propose a reasonable time frame, and name 
the officer delegated to conduct the audit 


vation 


he Commissioner has the 


1 witnesses, administer 


el organizations to produce 


are unlikely to be con- 
1 formal basis unless 
ion is not forthcoming. 


|| meet with the organiza- 


for a preliminary 
ent, purpose and scope 


requires access to any 
Ss premises, he or she will 
quirements. The officer 
y person in private on the 
» records and obtain copies 
h records. The officer will 
t within 10 days of a 
turn but may ask for them 


; finished, the officer will 
tion’s representative on 
+r will report the audit 
nissioner who will make 
e Commissioner will 
ye organization and may 
ned of actions the 
o correct problems. 
nay include the audit 
report or he may make 
nformation manage- 
in organization if he 
n the public interest 
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Privacy Questionna’: 


he following are some common sens: 

questions you can use to help your 

organization implement the Persona! 
Information Protection and Electronic lave 
Documents Act. The questionnaire may be 
used along with the description of the Act in 
this guide. 

If you are unsure about whether or wh¢ 
the Act applies to your organization, pleas 
refer to page 3 of this guide. 

Not all of the following questions wil! 
apply to all organizations, as the Act applie 
to a wide variety and size of organizations 
Consider each question along with your 
organization's current practices. Answering 
“no” indicates areas that need to be 
addressed or improved. 


4 


Personal information 

holdings 

_J Do you know what personal 
information is? 


_1 Do you collect, use or disclose 
personal information in your day-to-day 
commercial activities? 


_] Do you have an inventory of your 
personal information holdings? 

J Do you know where personal informatio: 
is held (physical locations and files)? 


Do you know in what format(s) the 
personal information is kept (electronic, 
paper, etc.)? 

Do you know who has access to persona’ 

information in and outside your 

organization? 


ity of 
vand staff 
d a privacy officer who is 


your organization’s overall 
1 the Act? 


ility shared with more 


ilities are shared, have 
identified? 
yd to internal and 
sestions on behalf of 


or do they know who 
«now who receives and 


sonal information? 
rection? 
the public? 


s know whom 


liries regarding their 
ation? 

ir personal information? 
ctions to their 


ition? 


ficer able to explain to 
ps and procedures for 


rsonal information and 
laints? 
staff been trained on the Act? 


be ongoing training? 
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_] Is your staff able to explain the purposes 
for the collection, use and disclosure of 
personal information to customers in 
easy to understand terms? 


_] Is your staff able to explain to customers 
when and how they may withdraw con- 
sent and what the consequences, if any, 
there are of such a withdrawal? 


“J Will you inform your employees of new 
privacy issues raised by technological 
changes, internal reviews, public com- 
plaints and decisions of the courts? 


Information for customers 
and employees 
_J Do you have documents that explain 


your personal information practices and 
procedures to your customers? 


LI Does this information include how to: 
4 obtain personal information? 
4 correct personal information? 
GQ make an inquiry or complaint? 


_1 Does this information describe personal 
information that is: 


4 held by the organization and how it 
is used? 


4 disclosed to subsidiaries and other 
third parties? 

_] Do you have a privacy policy for your 

Web site? 


_] Is your privacy policy prominent and easy 
to find? Is it easily understandable? 


_] Do your application forms, question- 
naires, survey forms, pamphlets and 
brochures clearly state the purposes 
for the collection, use or disclosure of 
personal information? 


J Have you reviewed all your public 
information material to ensure that 
any sections concerning personal infor- 
mation are clear and understandable? 


“J Have you ensured that the public can 
obtain this information easily and 
without cost? 


LI Is this information reviewed regularly to 
ensure that it is accurate, complete and 
up to date? 

J Does this information include the current 
name or title of the person who is respon- 
sible for overseeing compliance with 
the Act? 


Limiting collection, use, 

disclosure and retention 

to identified purposes 

_] Have you identified the purposes for 
collecting personal information? 


_} Are these purposes identified at or before 
the time the information is collected? 


_] Do you collect only the personal informa- 
tion needed for identified purposes? 


_] Do you document the purposes for which 
personal information is collected? 


_] If you gather and combine personal 
information from more than one source, 
do you ensure that the original purposes 
have not changed? 


_] Have you developed a timetable for 
retaining and disposing of personal 
information? 


LI When you no longer require personal 
information for the identified purposes 
or it is no longer required by law, do you 
destroy, erase or make it anonymous? 


Consent 


“1 Does your staff know that an individual's 
consent must be obtained before or at 
the time they collect personal informa- 
tion? 

1 Does your staff know they must obtain an 
individual's consent before any new use 
or new disclosure of the information? 


I Do you use express consent whenever 
possible, and in all cases where the info: 
mation is sensitive or the individual 
would reasonably expect it? 


I Is your consent statement worded clear! 
so that an individual can understand 
the purpose of the collection, use or 
disclosure? 


I Do you make it clear to customers that 


they need not provide personal informa. 


tion that is not essential to the purpose 
of the collection, use or disclosure? 


Third party transfers 


J Do you use contracts to ensure the 


protection of personal information trans 


ferred to a third party for processing? 


LJ Does the contract limit the third party's 


use of information to purposes necessary 


to fulfil the contract? 


LJ Does the contract require the third party 


to refer any requests for access or com 


plaints about the information transferred 


to you? 

_] Does the contract specify how and whe 
a third party is to dispose of or return an 
personal information it receives? 


Ensuring accuracy 


J Is personal information sufficiently accu 


rate, complete and up to date to minimize 


the possibility that your organization 
might use inappropriate information? 


J Does your organization document when 
and how personal information is update: 


to ensure its accuracy? 


4 Do you ensure that personal information 


received from a third party is accurate 
and complete? 


you reviewed your physical, techno- 
| and organizational security 


oper access, modifi- 
use, disclosure and/or 
Nal information? 
ation protected by 
that are appropriate 


‘need-to-know” 
personal informa- 
ry to perform 


trained about security 
personal information? 
aware that personal 
not be left displayed 

screens or desktops in 


at they should 
lividuals and establish 
he personal informa- 
it? 
out who is permitted 
2\ete personal 


anagement system 
ccounts, access rights 
rations? 
» unauthorized 
yf, obtain access to, 
nal information? 
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Requests for access to 
personal information 


O 


) 


Is your staff aware of the time limits the 
law allows to respond to access requests? 


Can you retrieve personal information to 
respond to individual access requests 
with a minimal disruption to operations? 


Do your information systems facilitate 
the retrieval and accurate reporting of 
an individual’s personal information, 
including disclosures to third party 
organizations? 


Do you provide personal information to 
the individual at minimal or no cost? 


Do you advise requesters of costs, if any, 
before personal information is retrieved? 


Do you record an individual's response to 
being notified of the cost of retrieving 
personal information? 


Do you provide personal information in a 
form that is generally understandable? (For 
example, do you explain abbreviations?) 


Does your organization have procedures 
for responding to requests for personal 
information in an alternate format (such 
as Braille or audiotapes)? 


Handling complaints 
_J Can an individual easily find out how to 
file a complaint with you? 


_] Do you deal with complaints in a timely 
fashion? 


_] Do you investigate all complaints 
received? 


L]) Are your customer assistance and other 
front-line staff able to distinguish a 
complaint under the law from a general 
inquiry? If unsure, do they discuss this 
with the individual? 


L} Do you advise individuals about all avail- 
able avenues of complaint, including the 
Privacy Commissioner of Canada? 


LI Are staff responses to public inquiries, 
requests and complaints reviewed to 
ensure they are handled fairly, accurately 
and quickly? 

_1 When a complaint is found to be justified, 
do you take appropriate corrective meas- 
ures, such as amending your policies and 
advising staff of the outcome? 
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